CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

LurkProxy

tool · tool:lurkproxy single-source

Network-proxy utility architecturally similar to the OctLurk backdoor but not itself a backdoor, deployed alongside OctLurk and SilkLurk. Kaspersky reports several of its command-server addresses also appear in a Kazakhstani government report on a separately tracked Linux implant, indicating shared infrastructure across campaigns without establishing whether they ran concurrently (Kaspersky GReAT, 2026-07-30).

Coverage
1
first 2026-07-31 → last 2026-07-31
Latest activity
2026-07-31
Kaspersky documents loaders that cannot be unpacked away from the host they infected, delivering…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, healthcare, education · regions: apac, middle-east, russia-cis
Sources cited
1
1 hosts

Defender insights

What each entry about LurkProxy tells a defender to do, newest first.

2026-07-31NOTABLEKaspersky documents loaders that cannot be unpacked away from the host they infected, delivering in-memory-only plugins

Triage · detection

Story timeline

  1. 2026-07-31OctLurk and SilkLurk, sibling plugin backdoors whose loaders key their payload decryption to the victim machine itself, deployed against Central Asian and Syrian government bodies
    active-threatsKaspersky documents loaders that cannot be unpacked away from the host they infected, delivering in-memory-only plugins

Hunting pivots

Tags
china-nexusespionageinfostealernation-state
ATT&CK techniques (15 across 8 tactics)

15 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ExecutionScheduled Task/Job: Scheduled Task · Command and Scripting Interpreter: Windows Command Shell
  • PersistenceScheduled Task/Job: Scheduled Task · Create or Modify System Process: Windows Service
  • Privilege EscalationScheduled Task/Job: Scheduled Task · Create or Modify System Process: Windows Service
  • StealthObfuscated Files or Information · Indicator Removal: Timestomp · Reflective Code Loading
  • Credential AccessOS Credential Dumping · Input Capture: Keylogging · Credentials from Password Stores: Credentials from Web Browsers
  • DiscoveryNetwork Service Discovery · Software Discovery: Security Software Discovery
  • CollectionInput Capture: Keylogging · Screen Capture · Email Collection · Clipboard Data
  • Command and ControlRemote Access Tools

Execution TA0002

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1059.003Command and Scripting Interpreter: Windows Command Shell×1

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Persistence TA0003

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1543.003Create or Modify System Process: Windows Service×1

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Privilege Escalation TA0004

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1543.003Create or Modify System Process: Windows Service×1

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1070.006Indicator Removal: Timestomp×1

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1620Reflective Code Loading×1

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Credential Access TA0006

T1003OS Credential Dumping×1

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×1

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Discovery TA0007

T1046Network Service Discovery×1

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1518.001Software Discovery: Security Software Discovery×1

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Collection TA0009

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1113Screen Capture×1

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1114Email Collection×1

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1115Clipboard Data×1

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Command and Control TA0011

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Entries about LurkProxy (1)

2026-07-31 · view entry permalink →

NOTABLENATOB2

OctLurk and SilkLurk, sibling plugin backdoors whose loaders key their payload decryption to the victim machine itself, deployed against Central Asian and Syrian government bodies

Kaspersky GReAT published analysis of two new plugin-based backdoors on 2026-07-30, naming them OctLurk and SilkLurk (Kaspersky Securelist, 2026-07-30). Victim organisations sit in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and Syria, across healthcare, research, government offices, foreign-affairs ministries, logistics, law enforcement, urban planning and public education. The victimology is out of scope for this constituency; the loader design and the plugin architecture are the reason the entry is here, because both are aimed squarely at the analysis and detection workflow a government SOC would use against them.

Everything here starts after the attacker already has administrative credentials. OctLurk's chain begins with a scheduled task created on remote machines with admin rights, set to run once under the System account immediately after creation. That task runs a batch script from a user profile folder or a temporary directory, which installs a Windows service; the service's ServiceMain registry parameter is then repointed to invoke an export of a malicious loader DLL rather than a legitimate service binary. The loader exports two functions, and the one the service calls simply invokes the other, which carries the actual logic. SilkLurk reaches the same place by a different route, its own service name, and side-loading under a legitimate binary rather than the ServiceMain repoint.

The loader is built to be useless to an analyst who does not also have the victim's machine. Taking OctLurk's, it locates its payload by decrypting a hard-coded byte blob through two successive XOR passes and a decompression step, then applies the identical process to the payload itself to produce the backdoor DLL. Two keys are involved: one is baked into the binary, and the second is derived at runtime from the serial number of the victim's C: drive. SilkLurk's loader does the same thing with a different host identifier, computing a hash of the victim's computer name. A sample lifted from one host therefore cannot be unpacked on an analyst's workstation, in a sandbox, or against any other victim; Kaspersky states plainly that the loaders are customised per victim and use information from the victim's machine to decrypt the payload. The resulting backdoor DLL is loaded reflectively into memory and never written to disk in decrypted form. The same double-XOR-and-compress framing wraps command-server traffic in both directions, with a freshly generated random key travelling in each packet header, so the wire format changes every session even though the static key does not.

Plugins arrive from the command server and stay in memory. Kaspersky documents three. A file manager enumerates volumes and directories, reads and writes files in chunks with integrity checking, executes commands, and (worth noting for anyone doing timeline work afterwards) deliberately rewrites file timestamps to attacker-supplied values. A command shell either maintains an interactive cmd.exe session or, when none is running, executes each command non-interactively with output redirected to a temporary file that it reads back and then deletes. An interaction manager captures the screen on demand or on an interval, reads and writes the clipboard, and synthesises mouse movement, clicks and keystrokes through low-level Windows input events, full hands-on-keyboard control delivered as a plugin rather than as a separate remote-access tool.

Post-compromise, the operators run a fingerprinting script that inventories sessions, Kerberos tickets, running tasks, antivirus products and Defender's tamper-protection and exclusion settings, network connections and hardware, and specifically queries the Windows Security log for the last few successful remote-interactive logons. They then deploy Impacket's secretsdump for credential extraction, a keylogger persisted under a scheduled task named after a legitimate remote-access product, a browser-password decryptor targeting Chrome and Firefox credential stores, Pandora RC agents for durable remote access, the FSCAN network scanner, and email-harvesting tooling. SilkLurk victims additionally receive PlugX (which Kaspersky describes as a modular remote-access trojan active since at least 2008 and historically linked to Chinese-speaking threat actors, and which is part of what supports its attribution language) and SilkLurk intrusions show operators mounting shares with harvested admin credentials, hunting documents by hand, and archiving them before exfiltration.

Kaspersky also reports that several command-server addresses used by OctLurk and its companion proxy utility appear in a Kazakhstani State Technical Service report on a separate Linux-targeting implant (tracked as TrustFall by that agency, MystRodX by Qianxin and SilentRaid by Cisco Talos) and it is explicit that this points to shared infrastructure across campaigns without establishing whether they ran at the same time.

Detection. Four behaviours here are strong hunt anchors and none of them depend on knowing this malware. First, service creation where the ServiceMain parameter points at a DLL export in a path outside the normal system directories, a configuration that legitimate services essentially never use. Second, a scheduled task created remotely to run once under System immediately after creation, executing a script from a user profile or temporary directory. Third, in process telemetry, the non-interactive shell pattern: a cmd.exe child redirecting output to a temporary file in the user temp directory, followed within moments by a read of that file and its deletion; the create-read-delete triple on a short-lived temp file is far more distinctive than any one of the three events. Fourth, in the same log the operators query, an inventory sweep that touches session enumeration, Kerberos ticket listing, antivirus product enumeration and Defender exclusion registry keys inside a single short window from one process lineage.

Triage: administrators run every one of those discovery commands individually, and management agents create services and scheduled tasks constantly. The discriminators are sequence and origin: the fingerprinting commands arrive as one uninterrupted batch from a single script rather than typed over minutes; the service points at a DLL export rather than an executable; and the scheduled task runs exactly once and never again, which is the opposite of what a legitimate maintenance task looks like.

We assess with medium confidence that the same actor is behind both backdoors, and that they are Chinese-speaking. However, at the time of publication, we couldn't attribute this activity to any known group.

The backdoor loaders are customized for each victim and use information from the victim's machine to decrypt the payload. Both the loaders and the backdoors are heavily obfuscated, making analysis more complicated.

Kaspersky Securelist (GReAT) 2026-07-30
threat31 Jul 04:09Zsingle-sourceOpen finding →
Sources: Kaspersky Securelist (GReAT)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • securelist.com1 (100%)
All cited sources (1)